Some good points but for me this misses the insider security risk of these organisations which scale doesn't help with. This could be the company acting against you or it could be an individual acting without authorisation.
Suppose you are a startup that may be of interest to Google in an acquisition, why even give them the opportunity to read your mail by using Gmail?
I also have some concerns that the stacked layers (SaaS tool, on Heroku on AWS) leaves you exposed at all these layers to a bigger pool of insiders and potential creates different opportunities for outsiders to attack although it may well still be more robust to external attack than self hosting.
His argument seems to boil down to 'give us all your data because any concerns you have are just insane!'. It really irks me to see someone dismiss privacy and security concerns with such derision. It's also not just companies who should be concerned. I think the growing unease in the EU about US access to cloud service data is only going to get more serious.
Unless the law mandates it and provides harsh penalties. Health care and financial companies, to name two industries, spend billions every year on security and privacy.
Spending billions != importance, especially if as you state it's mandated by law any way.
I wouldn't disagree with you though in regards to a large proportion of companies in those two areas. I however was specifically speaking of the other industries, the majority of which still see IT as an unnecessary expense and anything more than "new password every 30 days" as an inconvenience.
I don't know how I can generalize my experience but the research facility I work at prohibits use of Gmail (as POP3 client), AppEngine is completely out of question. Maybe it is less important if the company itself is in the US...
Suppose you are a startup that may be of interest to Google in an acquisition, why even give them the opportunity to read your mail by using Gmail?
I also have some concerns that the stacked layers (SaaS tool, on Heroku on AWS) leaves you exposed at all these layers to a bigger pool of insiders and potential creates different opportunities for outsiders to attack although it may well still be more robust to external attack than self hosting.